What is an open proxy and why is it a security risk?

An open proxy is a proxy server that forwards requests for any client on the internet without requiring authentication. Attackers use them to hide their origin, evade blocks and reach internal services. If you run a proxy, restrict who can use it and what it can reach.

What is a proxy, and when does it become open?

A proxy relays traffic between a client and a destination. In a forward proxy, the client asks the proxy to fetch something on its behalf. Standards such as RFC 1928 for SOCKS version 5 describe a framework for this: the client connects to the proxy, authenticates by one of the negotiated methods, and then asks the proxy to open a connection to a destination.

A proxy becomes open when the authentication step accepts anyone, or when the proxy is reachable from the whole internet with no source restrictions. The cause is usually a default configuration or a firewall rule that was meant to be temporary.

Why do attackers like them?

MITRE ATT&CK describes adversaries using proxies to direct network traffic between systems or to avoid direct connections to their command and control infrastructure, which makes network defenders' work harder. Technique T1090, Proxy, covers this, with sub techniques for internal proxies, external proxies and multi hop chains.

An open proxy you run gives an attacker three things:

Anonymity. Abuse shows your address in the logs, not theirs.

Reputation laundering. Spam, scraping and credential stuffing traffic comes from your address. Your address can land on blocklists, and your email may stop arriving.

Internal reach. If the proxy sits inside your network or can connect to private address ranges, an outsider can use it to talk to systems that were never meant to be exposed.

How does this relate to SSRF?

Server side request forgery, which OWASP lists in its API Security Top 10 as API7:2023, turns an application into an unintended proxy. If an API fetches a user supplied URL without validation, an attacker can make it request internal destinations. The two problems differ in how they arise but share a result: a trusted machine makes requests on behalf of an untrusted party.

Constructed example: the forgotten test proxy

A developer sets up a proxy on a cloud server to test a regional feature and opens port 3128 to the internet for convenience. It is never removed. Weeks later the provider notifies the company that the address has been reported for abuse. The access log shows thousands of requests per hour from unknown clients to unrelated websites. The company's own use was a few requests. Closing the port ends the abuse, and the address takes time to recover its reputation.

How do you test whether one is open?

From outside your network, try to connect to common proxy ports on your own addresses and see whether a request to a harmless external site succeeds without credentials. Check only systems you own or are authorized to test. Review your firewall rules and cloud security groups for rules that expose proxy ports and software.

How to check or apply this

1. Inventory every proxy and relay service you run, including ones on developer machines and cloud test servers.
2. Require authentication on any proxy that must be reachable, and limit source addresses to known ranges.
3. Block proxies from connecting to private address ranges and cloud metadata addresses unless there is a stated need.
4. Log requests and alert on unusual volumes or destinations.
5. Scan your external address ranges regularly for exposed proxy ports.
6. In application code, validate and allow list outbound URLs before fetching them.

Quick check

Sources

• RFC 1928, SOCKS Protocol Version 5
• MITRE ATT&CK T1090, Proxy
• OWASP API Security Top 10 2023, API7 Server Side Request Forgery

Last reviewed: 18 October 2026.